To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/password-request.xml
- browse files at revision 170
- compare with another revision
- download diff
- download tarball
- view history from revision 170
- Committer: Teddy Hogeborn
- Date: 2008-09-06 16:11:50 UTC
- Revision ID: teddy@fukt.bsnet.se-20080906161150-1umb8yz6a29zxg28
* Makefile (install-client): Add "/etc/plugins.d/README".
(uninstall-client): Remove "/etc/plugins.d/README".
* etc-plugins.d-README: New file.
(uninstall-client): Remove "/etc/plugins.d/README".
* etc-plugins.d-README: New file.
added
removed
plugins.d/password-request.xml
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY VERSION "1.0">
5
5
<!ENTITY COMMANDNAME "password-request">
6
<!ENTITY TIMESTAMP "2008-09-03">
6
<!ENTITY TIMESTAMP "2008-09-04">
7
7
]>
8
8
9
9
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
54
54
<command>&COMMANDNAME;</command>
55
55
<group>
56
56
<arg choice="plain"><option>--connect
57
<replaceable>IPADDR</replaceable><literal>:</literal
57
<replaceable>ADDRESS</replaceable><literal>:</literal
58
58
><replaceable>PORT</replaceable></option></arg>
59
59
<arg choice="plain"><option>-c
60
<replaceable>IPADDR</replaceable><literal>:</literal
60
<replaceable>ADDRESS</replaceable><literal>:</literal
61
61
><replaceable>PORT</replaceable></option></arg>
62
62
</group>
63
63
<sbr/>
64
64
<group>
65
<arg choice="plain"><option>--keydir
66
<replaceable>DIRECTORY</replaceable></option></arg>
67
<arg choice="plain"><option>-d
68
<replaceable>DIRECTORY</replaceable></option></arg>
69
</group>
70
<sbr/>
71
<group>
72
65
<arg choice="plain"><option>--interface
73
66
<replaceable>NAME</replaceable></option></arg>
74
67
<arg choice="plain"><option>-i
131
124
network connectivity, Zeroconf to find servers, and TLS with an
132
125
OpenPGP key to ensure authenticity and confidentiality. It
133
126
keeps running, trying all servers on the network, until it
134
receives a satisfactory reply or a TERM signal is recieved.
127
receives a satisfactory reply or a TERM signal is received.
135
128
</para>
136
129
<para>
137
130
This program is not meant to be run directly; it is really meant
191
184
</varlistentry>
192
185
193
186
<varlistentry>
194
<term><option>--keydir=<replaceable
195
>DIRECTORY</replaceable></option></term>
196
<term><option>-d
197
<replaceable>DIRECTORY</replaceable></option></term>
198
<listitem>
199
<para>
200
Directory to read the OpenPGP key files
201
<filename>pubkey.txt</filename> and
202
<filename>seckey.txt</filename> from. The default is
203
<filename>/conf/conf.d/mandos</filename> (in the initial
204
<acronym>RAM</acronym> disk environment).
205
</para>
206
</listitem>
207
</varlistentry>
208
209
<varlistentry>
210
187
<term><option>--interface=
211
188
<replaceable>NAME</replaceable></option></term>
212
189
<term><option>-i
232
209
<replaceable>FILE</replaceable></option></term>
233
210
<listitem>
234
211
<para>
235
OpenPGP public key file base name. This will be combined
236
with the directory from the <option>--keydir</option>
237
option to form an absolute file name. The default name is
238
<quote><literal>pubkey.txt</literal></quote>.
212
OpenPGP public key file name. The default name is
213
<quote><filename>/conf/conf.d/mandos/pubkey.txt</filename
214
></quote>.
239
215
</para>
240
216
</listitem>
241
217
</varlistentry>
247
223
<replaceable>FILE</replaceable></option></term>
248
224
<listitem>
249
225
<para>
250
OpenPGP secret key file base name. This will be combined
251
with the directory from the <option>--keydir</option>
252
option to form an absolute file name. The default name is
253
<quote><literal>seckey.txt</literal></quote>.
226
OpenPGP secret key file name. The default name is
227
<quote><filename>/conf/conf.d/mandos/seckey.txt</filename
228
></quote>.
254
229
</para>
255
230
</listitem>
256
231
</varlistentry>
336
311
<filename>/etc/crypttab</filename>, but it would then be
337
312
impossible to enter a password for the encrypted root disk at
338
313
the console, since this program does not read from the console
339
at all. This is why a separate plugin does that, which will be
340
run in parallell to this one by the plugin runner.
314
at all. This is why a separate plugin (<citerefentry>
315
<refentrytitle>password-prompt</refentrytitle>
316
<manvolnum>8mandos</manvolnum></citerefentry>) does that, which
317
will be run in parallel to this one by the plugin runner.
341
318
</para>
342
319
</refsect1>
343
320
409
386
</informalexample>
410
387
<informalexample>
411
388
<para>
412
Search for Mandos servers on another interface:
389
Search for Mandos servers (and connect to them) using another
390
interface:
413
391
</para>
414
392
<para>
415
393
<!-- do not wrap this line -->
418
396
</informalexample>
419
397
<informalexample>
420
398
<para>
421
Run in debug mode, and use a custom key directory:
399
Run in debug mode, and use a custom key:
422
400
</para>
423
401
<para>
424
<!-- do not wrap this line -->
425
<userinput>&COMMANDNAME; --debug --keydir keydir</userinput>
402
403
<!-- do not wrap this line -->
404
<userinput>&COMMANDNAME; --debug --pubkey keydir/pubkey.txt --seckey keydir/seckey.txt</userinput>
405
426
406
</para>
427
407
</informalexample>
428
408
<informalexample>
429
409
<para>
430
Run in debug mode, with a custom key directory, and do not use
431
Zeroconf to locate a server; connect directly to the IPv6
432
address <quote><systemitem class="ipaddress"
410
Run in debug mode, with a custom key, and do not use Zeroconf
411
to locate a server; connect directly to the IPv6 address
412
<quote><systemitem class="ipaddress"
433
413
>2001:db8:f983:bd0b:30de:ae4a:71f2:f672</systemitem></quote>,
434
414
port 4711, using interface eth2:
435
415
</para>
436
416
<para>
437
417
438
418
<!-- do not wrap this line -->
439
<userinput>&COMMANDNAME; --debug --keydir keydir --connect 2001:db8:f983:bd0b:30de:ae4a:71f2:f672:4711 --interface eth2</userinput>
419
<userinput>&COMMANDNAME; --debug --pubkey keydir/pubkey.txt --seckey keydir/seckey.txt --connect 2001:db8:f983:bd0b:30de:ae4a:71f2:f672:4711 --interface eth2</userinput>
440
420
441
421
</para>
442
422
</informalexample>
446
426
<title>SECURITY</title>
447
427
<para>
448
428
This program is set-uid to root, but will switch back to the
449
original user and group after bringing up the network interface.
429
original (and presumably non-privileged) user and group after
430
bringing up the network interface.
450
431
</para>
451
432
<para>
452
433
To use this program for its intended purpose (see <xref
474
455
>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
475
456
</para>
476
457
<para>
477
<emphasis>Note</emphasis>: This makes it impossible to have
478
<application >Mandos</application> clients which dual-boot to
479
another operating system which does <emphasis>not</emphasis> run
480
a <application>Mandos</application> client.
458
It will also help if the checker program on the server is
459
configured to request something from the client which can not be
460
spoofed by someone else on the network, unlike unencrypted
461
<acronym>ICMP</acronym> echo (<quote>ping</quote>) replies.
462
</para>
463
<para>
464
<emphasis>Note</emphasis>: This makes it completely insecure to
465
have <application >Mandos</application> clients which dual-boot
466
to another operating system which is <emphasis>not</emphasis>
467
trusted to keep the initial <acronym>RAM</acronym> disk image
468
confidential.
481
469
</para>
482
470
</refsect1>
483
471
484
472
<refsect1 id="see_also">
485
473
<title>SEE ALSO</title>
486
474
<para>
475
<citerefentry><refentrytitle>cryptsetup</refentrytitle>
476
<manvolnum>8</manvolnum></citerefentry>,
477
<citerefentry><refentrytitle>crypttab</refentrytitle>
478
<manvolnum>5</manvolnum></citerefentry>,
487
479
<citerefentry><refentrytitle>mandos</refentrytitle>
488
480
<manvolnum>8</manvolnum></citerefentry>,
489
481
<citerefentry><refentrytitle>password-prompt</refentrytitle>
491
483
<citerefentry><refentrytitle>plugin-runner</refentrytitle>
492
484
<manvolnum>8mandos</manvolnum></citerefentry>
493
485
</para>
494
<itemizedlist>
495
<listitem><para>
496
<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
497
</para></listitem>
498
499
<listitem><para>
500
<ulink url="http://www.avahi.org/">Avahi</ulink>
501
</para></listitem>
502
503
<listitem><para>
504
<ulink
505
url="http://www.gnu.org/software/gnutls/">GnuTLS</ulink>
506
</para></listitem>
507
508
<listitem><para>
509
<ulink
510
url="http://www.gnupg.org/related_software/gpgme/"
511
>GPGME</ulink>
512
</para></listitem>
513
514
<listitem><para>
515
<citation>RFC 4880: <citetitle>OpenPGP Message
516
Format</citetitle></citation>
517
</para></listitem>
518
519
<listitem><para>
520
<citation>RFC 5081: <citetitle>Using OpenPGP Keys for
521
Transport Layer Security</citetitle></citation>
522
</para></listitem>
523
524
<listitem><para>
525
<citation>RFC 4291: <citetitle>IP Version 6 Addressing
526
Architecture</citetitle>, section 2.5.6, Link-Local IPv6
527
Unicast Addresses</citation>
528
</para></listitem>
529
</itemizedlist>
486
<variablelist>
487
<varlistentry>
488
<term>
489
<ulink url="http://www.zeroconf.org/">Zeroconf</ulink>
490
</term>
491
<listitem>
492
<para>
493
Zeroconf is the network protocol standard used for finding
494
Mandos servers on the local network.
495
</para>
496
</listitem>
497
</varlistentry>
498
<varlistentry>
499
<term>
500
<ulink url="http://www.avahi.org/">Avahi</ulink>
501
</term>
502
<listitem>
503
<para>
504
Avahi is the library this program calls to find Zeroconf
505
services.
506
</para>
507
</listitem>
508
</varlistentry>
509
<varlistentry>
510
<term>
511
<ulink url="http://www.gnu.org/software/gnutls/"
512
>GnuTLS</ulink>
513
</term>
514
<listitem>
515
<para>
516
GnuTLS is the library this client uses to implement TLS for
517
communicating securely with the server, and at the same time
518
send the public OpenPGP key to the server.
519
</para>
520
</listitem>
521
</varlistentry>
522
<varlistentry>
523
<term>
524
<ulink url="http://www.gnupg.org/related_software/gpgme/"
525
>GPGME</ulink>
526
</term>
527
<listitem>
528
<para>
529
GPGME is the library used to decrypt the OpenPGP data sent
530
by the server.
531
</para>
532
</listitem>
533
</varlistentry>
534
<varlistentry>
535
<term>
536
RFC 4291: <citetitle>IP Version 6 Addressing
537
Architecture</citetitle>
538
</term>
539
<listitem>
540
<variablelist>
541
<varlistentry>
542
<term>Section 2.2: <citetitle>Text Representation of
543
Addresses</citetitle></term>
544
<listitem><para/></listitem>
545
</varlistentry>
546
<varlistentry>
547
<term>Section 2.5.5.2: <citetitle>IPv4-Mapped IPv6
548
Address</citetitle></term>
549
<listitem><para/></listitem>
550
</varlistentry>
551
<varlistentry>
552
<term>Section 2.5.6, <citetitle>Link-Local IPv6 Unicast
553
Addresses</citetitle></term>
554
<listitem>
555
<para>
556
This client uses IPv6 link-local addresses, which are
557
immediately usable since a link-local addresses is
558
automatically assigned to a network interfaces when it
559
is brought up.
560
</para>
561
</listitem>
562
</varlistentry>
563
</variablelist>
564
</listitem>
565
</varlistentry>
566
<varlistentry>
567
<term>
568
RFC 4346: <citetitle>The Transport Layer Security (TLS)
569
Protocol Version 1.1</citetitle>
570
</term>
571
<listitem>
572
<para>
573
TLS 1.1 is the protocol implemented by GnuTLS.
574
</para>
575
</listitem>
576
</varlistentry>
577
<varlistentry>
578
<term>
579
RFC 4880: <citetitle>OpenPGP Message Format</citetitle>
580
</term>
581
<listitem>
582
<para>
583
The data received from the server is binary encrypted
584
OpenPGP data.
585
</para>
586
</listitem>
587
</varlistentry>
588
<varlistentry>
589
<term>
590
RFC 5081: <citetitle>Using OpenPGP Keys for Transport Layer
591
Security</citetitle>
592
</term>
593
<listitem>
594
<para>
595
This is implemented by GnuTLS and used by this program so
596
that OpenPGP keys can be used.
597
</para>
598
</listitem>
599
</varlistentry>
600
</variablelist>
530
601
</refsect1>
531
602
532
603
</refentry>
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0